Executive Summary
A targeted malware campaign active between April and June 2026 has been identified focusing on the Thai healthcare sector, including Ministry of Health personnel and hospital staff. The attackers utilize sophisticated spear-phishing lures, such as fake medical equipment approval documents and patient records, to deliver malicious RAR archives.
The attack chain involves highly obfuscated batch scripts (using the Rouki framework) and secondary payloads hosted on GitHub. The final stage is a Python-based information stealer (sim.py) that targets browser credentials and session data, attempting to exfiltrate the stolen information to attacker-controlled Telegram channels. This demonstrates a high level of operational tailoring and sector-specific knowledge.
The use of legitimate infrastructure like GitHub and Telegram, combined with layered obfuscation and bundled Python interpreters, makes this threat particularly adept at evading standard security controls. Organizations in the region should increase monitoring for document-themed phishing and unauthorized modifications to Windows Startup folders.